MMRat
MMRat is an Android remote access trojan used in mobile banking fraud campaigns attributed in the provided reporting to the financially motivated Chinese-speaking group GoldFactory. It has been deployed in attacks targeting users in Indonesia, Thailand, and Vietnam, where victims are socially engineered via phone calls and messaging apps such as Zalo, impersonating government or public-service entities and redirecting targets to fake Google Play Store pages. These lures lead to installation of malware including Gigabud, MMRat, and Remo.
In the described campaigns, the malware is delivered through modified legitimate banking applications and abuses Android accessibility services to enable remote control and fraudulent activity while preserving normal app functionality. The broader toolset used in these operations employs runtime hooking frameworks and malware families such as FriHook, SkyHook, and PineHook to bypass security controls and conceal malicious behavior. Reported capabilities in the campaign ecosystem include hiding accessibility-enabled apps, preventing screencast detection, spoofing app signatures, hiding installation sources, implementing custom integrity tokens, and obtaining account balances. High-confidence reporting directly ties MMRat to GoldFactory’s Android-focused operations and to fake banking-app distribution infrastructure affecting Southeast Asian mobile users.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...resulting in the deployment of a remote access trojan like Gigabud, MMRat, or Remo, which surfaced earlier this year using the same tactics as GoldFactory.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan for Android, distributed via fake banking apps, enabling remote control and abuse of accessibility services.
Android remote access trojan used for device control and data theft, distributed via fake app listings.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.